HackTool - Defendnot Installation via PowerShell One-Liner

Title: HackTool - Defendnot Installation via PowerShell One-Liner
Status: experimental
Description:Detects execution of Defendnot installation via PowerShell one-liner that downloads and executes the Defendnot script from a remote URL. Defendnot is a hacktool that abuses Microsoft's undocumented WSC API to disable Windows Defender by registering itself as a fake antivirus product.
References:
  -https://github.com/es3n1n/defendnot/blob/525176a37721ead27d3f9f77f59b58abfc305988/README.md#one-liner
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2026-10-18
modified:None
Tags:

• -'attack.defense-impairment'
• -'attack.t1685'

Logsource:

• category: ps_script
• product: windows

Detection:
  selection:
ScriptBlockText|contains:'https://dnot.sh/'     - ScriptBlockText|contains|all:
      - '/defendnot'
      - 'github'
  condition:selection
Falsepositives:
  -Unlikely
Level: high